Zyvara

Logo
Discover practical environmental challenges and build lasting habits through small everyday actions.
Each challenge provides a clear mission, evidence requirements, and participation points.
The community feed shares contributions that received a supported evidence assessment and were shared with consent.
Explore cleanup, planting, recycling, and conservation challenges in one catalogue.
Filter challenges by category to find an action that fits your interests.
Planting challenges turn environmental intentions into specific actions with clear documentation steps.

Inspiration

Most people want to live more sustainably, but everyday green actions feel invisible and unrewarded. Zyvara turns them into shared, verifiable challenges. Someone posts an environmental challenge, participants complete it and submit photo evidence, and an AI-assisted review recognizes the effort with points. We wanted it to feel like a community project, not a lecture, and to reward real actions without inventing impact numbers.

What it does

Zyvara is a responsive web app (zyvara.us) for discovering and completing environmental challenges.

Discover: search and filter challenges by category, then open a detail page with requirements and rewards.
Submit evidence: sign in, upload a private photo and a description, and the evidence is finalized as an immutable record.
Assessment: Gemini evaluates each submission server-side and returns supported, needs more evidence, or not supported. The original feedback is always retained.
Points: creators choose a reward $p \in {1, 2, \dots, 1000}$ (default $p = 50$). Points are awarded once per submission, are duplicate-safe, and come only from stored rewards. We never invent carbon savings or confidence percentages.
Creator review: creators can't submit to their own challenges, but they can review the latest evidence, record a reason, and approve or deny it once per evidence version. Denial reverses the award.
Community sharing: off by default. Only consented, supported, non-hidden evidence is public, and withdrawing consent takes effect immediately.
Creator tools: manual challenge creation, closure, post-publication settings (points, font family, text size), owner deletion, reporting, and admin hiding.
Accessibility: persistent Small, Default, and Large text sizes.

How we built it

App: Next.js App Router, React, and TypeScript, themed from our original design-system files.
Data: Drizzle ORM with PostgreSQL (Tiger Data in production, PGlite locally) and versioned migrations.
Auth: Firebase Auth on the free Spark tier with verified, revocation-checked session cookies, plus a restricted local demo mode.
Photos: stored in PostgreSQL, so no paid bucket is needed. The browser shrinks large files, then the server validates them, strips metadata, and stores sanitized WebP copies (1280 px longest edge, quality 75, at most 1 MiB each). Retrieval goes through an authorized /api/media/:uploadId route with no permanent private URLs.
AI: a server-side Gemini module, with a deterministic mock provider for development and testing. Every mock result is labeled as simulated.
Quality: typecheck, lint, integrity tests (transactions, concurrency, ledger reconciliation) on a disposable Postgres database, Playwright E2E, and GitHub Actions CI. Deployed on Vercel.

Challenges we ran into

Keeping rewards trustworthy: concurrent submissions, retries, and stale AI results could double-award or overwrite points. We solved it with atomic transactions, evidence revisions, and ledger reconciliation tests.
Privacy vs. community: photos are private by default, so publication and withdrawal had to take effect immediately. We used private, no-store caching and per-request ownership and publication checks.
Free-tier constraints: with no storage bucket or billing upgrade, we built quota-limited PostgreSQL photo storage with advisory locks and aggressive server-side compression.
Unreliable AI calls: providers fail, so we added resumable processing jobs, capped retries (five attempts per evidence version), request throttling, and failure-once and permanent-failure test fixtures.
Verifying integrations honestly: adapter code isn't proof of a working Firebase or Gemini connection, so we documented exactly what must be proven live before launch.

Accomplishments that we're proud of

An end-to-end flow from discovery to evidence to assessment to points to optional sharing, with consent and withdrawal built in.
A points system with no fabricated impact statistics, duplicate-safe awards, and reversible creator decisions.
Integrity testing against a real Postgres database, not just mocks.
A privacy-first design: sanitized images, no permanent private URLs, and sharing off by default.
Running entirely on free tiers while staying honest about its limits.

What we learned

Trust and abuse prevention (rate limits, moderation, idempotent awards) matter as much as the core feature.
Treating AI output as advisory, with creator review and retained original feedback, makes the system fairer.
Designing around constraints like free hosting, request-size limits, and no queue forces clearer architecture.
Docs and verification notes are part of the product when integrations depend on external credentials.

What's next for Zyvara

A background worker or queue so assessments complete without the user returning.
Cleanup of abandoned uploads, plus account-level deletion, backup/restore, and a defined retention policy.
A moderation workflow for reports, plus an organizer contact.
Live verification of Google sign-in, uploads, media retrieval, and cross-user isolation on the deployed site.
Likes, comments, and email-link sign-in, and a move to dedicated object storage as usage grows.